Open source · runs on your computer

Your AI agents get only what you allow.

gate4.ai is a guard for your computer. Claude, ChatGPT, OpenClaw and Hermes reach your email, files and browser through it, under your rules: allow, deny, or ask you first. Agents never see your passwords, and every action leaves proof.

macOS / Linux Windows

$ curl -fsSL https://gate4.ai/install.sh | sh

PS> irm https://gate4.ai/install.ps1 | iex

macOS, Linux, Windows · no admin rights · v0.1.1

gate4ai · live journal

Agent
Claude.ai wants email.send
to landlord@example.com · “Rent for October”
Rule
email-send-trusted: recipient is not in your trusted contacts ask
You
Telegram · gate4ai Claude.ai wants to email landlord@example.com DenyAllow
Proof
sent SMTP 250 OK · saved to journal #1842

Agents are getting the keys to everything. One bad email is enough to turn that into actions.

01
Too much access
Personal agents get a whole shell, a logged-in browser and your entire mailbox. There is no “only this, only that much”.
02
Prompt injection becomes action
A web page or an email with hidden instructions can make an agent forward your data or pay someone.
03
“Done” without proof
Agents report success they did not achieve. Without a server response or a screenshot, you cannot tell.

How it works

One gate between all your agents and your computer.

Your agentsClaude.ai · ChatGPT · Claude Code · OpenClaw · Hermes

gate4.ai allowdenyask you rules · limits · vault · journal

ConnectorsEmail · Files · Browser

Rules per agent

Who, what, to whom and how much. Each agent gets its own token and profile, and one set of rules covers them all.

Passwords stay with you

Agents and connectors see aliases like @mail.work. gate4ai fills in the secret itself, only for the server it belongs to.

Proof for every action

Each request, decision and result goes to a tamper-evident journal. gate4ai journal verify checks it end to end.

Approve from anywhere

A desktop notification and the tray icon, Telegram, or the local Web UI. No answer in time means no.

Rules in plain words

Say what is fine. gate4ai holds the line.

“Email my accountant freely. Anyone else, ask me first.”

Trusted contacts go out at once; any other recipient waits for your tap.

- id: email-accountant
  action: email.send
  when: to.all(r, r in lists.contacts_trusted)
  effect: allow
- id: email-others
  action: email.send
  effect: ask

“Read my notes. Change them only after I approve in Telegram.”

Reading is silent; every edit becomes a message with Allow and Deny.

- id: notes-read
  action: files.read
  when: glob(path, "~/Documents/notes/**")
  effect: allow
- id: notes-append
  action: files.append
  when: glob(path, "~/Documents/notes/**")
  effect: ask

“Never write to an address the agent found in an incoming email. And no more than 20 emails a day.”

gate4ai tracks where each argument came from, so a planted address is refused.

- id: no-injected-recipients
  action: email.send
  when: "'untrusted_content' in provenance.to"
  effect: deny
limits:
  - { id: mail-per-day, action: email.send, per_day: 20 }

Works with your agents

Cloud or local, one set of rules.

Claude.ai

Remote MCP through the relay. No open ports, and the relay cannot read your traffic.

ChatGPT

The same remote MCP connector, connected with a one-time code.

Claude Code

MCP over stdio, or fully isolated with gate4ai run: network and files only through gate4ai.

OpenClaw · Hermes

CLI plus a ready skill file: gate4ai skill > SKILL.md.

Connectors

Each connector declares what it may touch.

All connectors

browser Verified Read pages in the user's dedicated Chrome profile Opens only sites from your allowed_domains setting in the browser gate4ai · v2 email Verified Email over IMAP/SMTP Connects only to imap.host:imap.port from your settings gate4ai · v2 files Verified Files in allowed folders Works with files only inside folders from your roots setting gate4ai · v2

Built to be checked

You should not have to trust us. So you can verify.

Open source
Core, relay, SDK and connectors are on GitHub. The core is FSL-1.1 and becomes Apache-2.0 after two years.
Signed releases
Checksums are signed with cosign; the installer refuses a tampered archive.
Signed connectors
Packages are signed by the publisher, the store index by gate4.ai. Revoked versions do not install.
Local first
No account and no cloud. Your rules, secrets and journal stay on your computer; the relay is optional.

Put a guard on your agents in a minute.